Not to mention since COM support will allow you to access the registry, you can use COM to turn off lock settings, so if COM is allowed, even if every other dangerous command is not, you can just edit the registry and delete the key that stores the "lock" options.
